Start here: http://answers.splunk.com/answers/2602/can-splunk-filter-match-events-and-bring-back-neighbouring-events-like-gnu-grep.html ... View more

This is certainly possible, and there's no need to think about writing your own webapp and trying to integrate against the python SDK. that's silly. Since he's only asking to embed the dynamic value within simple text, the trick is that all that text goes into the SingleValue params, and none into the . Also, this sort of thing is a lot easier in Sideview Utils. Sideview Utils contains 20-some pages of its own docs, among which you'll find "Using the HTML module to replace SingleValue". However you'll also have to say goodbye to the simple xml. ... View more

I'm not sure exactly what you're trying to count? Is it just "IPs that appear in the last 5 minutes that have also not appeared in the prior 30 minutes (or 25 minutes")"? That is, the number of new visits in the most recent 5 minute window? The simple way of doing this is: sourcetype=log earliest=-38m@m latest=-3min@m | stats min(_time) as earliest by ip | where earliest < relative_time(now(),"-8m@m") | stats count A more efficient way, knowing that you are running this every 5 minutes would be to run a search that built and updated a lookup table with the new IPs seen in the last 5 minutes as it went: sourcetype=log earliest=-8m@m latest=-3m@m | stats min(_time) as earliest by ip | inputlookup append=t recentips | stats min(_time) as earliest by ip | where earliest > relative_time(now(),"-38m@m") | outputlookup recentips And to get the number for you more recent 5 minute interval (after the other search has run) | inputlookup recentips | where earliest > -8m@m | stats count ... View more

I have not yet combined overlay charts with post-processing, but just a few hints: Have you tested this post-processing with a standard chart without overlay technique? From a gutt feeling I would say that the base search is not defined properly to fill the post-processing search. I have worked a bit with the post-processing in sideview, and from this brilliant documentation I learned how to use post-processing. From my understanding you need a reporting command like stats in your base search and list the fields, which you want to use in the post-processing search later on. ... View more

Is this issue fixed?? ... View more

You have asked this question twice; please see my explanation at the other instance, http://answers.splunk.com/questions/9053/example-of-chart-overlay ... View more

Oh, I should also point out I am running the 4.1.2 Light Forwarder. and monitoring the W3SVC1 folder. Thanks ... View more

It is broken in 5.0.3 still.... I'm getting iis-2 sourcetype despite hardcoding it in inputs.conf ... View more